[dependabot]

Bumps the dependencies group with 12 updates:

Package	From	To
@biomejs/biome	2.5.15	2.6.3
knip	6.42.0	6.43.0
@google-cloud/bigquery	9.3.0	9.5.0
@google-cloud/datastore	11.3.0	11.3.1
@google-cloud/pubsub	6.3.0	6.3.1
@kubernetes/client-node	2.0.0	2.0.1
@aws-sdk/client-s3	3.1152.0	3.1156.0
mockserver-client	9.0.0	9.1.0
mongoose	9.11.2	9.11.4
mssql	12.7.10	12.7.11
@types/oracledb	7.0.3	26.0.0
@qdrant/js-client-rest	1.19.0	1.20.0

Updates @biomejs/biome from 2.5.15 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

• #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

  const minimum = array.toSorted((a, b) => a - b)[0];

• #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

• #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

  for (const name of users.map((user) => user.name)) {
    console.log(name);
  }

• #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

• #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

  <table bgcolor="#ffffff" cellpadding="5"></table>

• #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

  const fullPath = __dirname + "/foo.js"; // reported

• #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

  await page.locator("button").first().click();

• #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

  @layer components {
    @layer components {
      .button {
        color: red;
      }

... (truncated)

Commits

• c5c3383 ci: release (#12500)
• 7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
• 807e616 feat(lint): add noArraySortForMinMax (#12275)
• 407604d feat(lint): add useVueComponentIs (#12400)
• f748ec0 feat(lint): add noSvelteInternal (#12431)
• ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
• bf1a55a feat(lint): add useVueVOnExact (#12423)
• c371520 feat(lint): add useVueToggleInsideTransition (#12337)
• 8a5974a chore: add syntaxfm to sponsors (#12577)
• 0be8d10 feat(lint): add noUnsafeReturn (#12422)
• Additional commits viewable in compare view

Updates knip from 6.42.0 to 6.43.0

Release notes

Sourced from knip's releases.

Release 6.43.0

• Document and pin exports that only keep each other alive (#2160) (39af70abb32523a992a7d6152b8cd95ef317f237)
• Don't add config files without an extension as entry files (resolve #2168) (46a825ddf15d3073b899ed6ef34689e5da5508f2)
• Recognize unscoped ~name workspace packages (resolve #2172) (ba527f7386e7741507f2f18d84864058e02ac907)
• Follow imports and re-exports in ambient modules (resolve #2174) (dbd3a8b8b0429433e5385371c09e805b808a32c2) - thanks @​tlq5l!
• Follow @reference in Tailwind CSS compiler (#2177) (219f16de95e174cdcfd6a90782bcef13cf79bd64) - thanks @​mkantautas!
• Support { find, replacement } array form of Vite alias (#2179) (5d0779bc4cf8c0469c50d5b2cda1a6bd1f053d81) - thanks @​mkantautas!
• fix(expo): treat local config plugins as entry files (#2176) (100ef491509a88b00ea9956ba40dbc1b0ac0c205) - thanks @​Cayan!
• fix(next): detect Turbopack loaders in shared config factories (#2161) (9cf928be5022928a38c12fe8001cec7bf467040c) - thanks @​jakeleventhal!
• Ignore osascript as global binary (#2182) (c301e44c7975442d4d25595f084e6b853f07a434) - thanks @​abrahamguo!
• Skip --fix for exports in multi-declarator variable statements (#2178) (326afd9c1e66eef04d986b83ed829b506f506c48) - thanks @​mkantautas!
• Watch the project directory instead of process.cwd() (#2183) (16d9932d0239f649cf2c1349cc7bc893850cd4f0) - thanks @​abrahamguo!
• Follow directory paths in tsconfig references (#2186) (d741c46e3f2a9caaf6bf4e81e9d4c8cfca48623e) - thanks @​mkantautas!
• Handle @plugin options blocks in Tailwind CSS compiler (#2187) (9fae773eb75bcba03e62f44ce3e9aa0b889bf4ac) - thanks @​mkantautas!
• Remove anonymous default-exported functions and classes in --fix (#2188) (6748259fbb2ea9a5940ea3861626f77677610a86) - thanks @​mkantautas!
• Recognize bun fmt as a built-in command (#2189) (e971b0924bcb7ff8dcab01a180d3016cc08b675d) - thanks @​TomasHubelbauer!
• Add plugin for @​bufbuild/buf (#2142) (90216c261c2273967125669beb611bf763d762c7) - thanks @​ryanquinn3!
• Pass isSsrBuild to Vite config functions (#2191) (d2aa101c55e5d7e8d26548808ce008b214622099) - thanks @​mkantautas!
• Follow src of <script> and <style> blocks in Vue SFCs (#2193) (3d148393d5129a096a182fab36a873b9f710f388) - thanks @​mkantautas!
• Remove import attributes with emptied re-exports in --fix (#2192) (231026cf9c21cc7890f21d048f4af6ea7233d7b8) - thanks @​mkantautas!
• Update npmx.dev snapshot (b2cc439006ec98ff5bbc1c99b99bc1ac5203b6b2)
• Read string parserOptions.parser in ESLint flat configs (#2198) (302f908aa135669d6fe96869ec6452b7570856a4) - thanks @​mkantautas!
• Resolve directory matches in Vitest test.projects to their config (#2195) (4d386138011c27e01e6e910be6d58266e07c9cf1) - thanks @​fixfon!
• Ignore custom elements named script-* when extracting script blocks (#2199) (23e6479b233e1882ddaf29736390309d0f3f040f) - thanks @​mkantautas!
• feat(mcp): add MCP plugin (#2180) (fc92470a9f687e2f1da60b84612ebf3e59a8bbb9) - thanks @​jakeleventhal!
• Handle non-Error plugin config failures (8f21ea2182fac5a96edd7d6d4280a0fa1051e434)
• Update articles list (6569cdcde1a79a6196a35a934b6c0d9d0e23faa4)
• Skip --fix export ranges inside a larger removal (204a8091baf91cb8cfb4e7a9aa70d461cc926baa)
• Detect .travis.yml with a stat instead of a glob (3601c6e32afef3d1d76a3944e540225da5190b9b)
• Mark YAML catalog entries fixed only when their line is removed (#2201) (813fa30e55ef3a8ed749d9d6d5a02a00810cfe72) - thanks @​mkantautas!
• Add Electron Forge plugin (#2158) (12e4355a43ea63c417d3b9ebfbbac1c8510b139e) - thanks @​mehdimirzafaruk!
• Resolve function and promise entries in Vitest test.projects (#2197) (ec293d1a33d30a8b0521725d1148e6e72c6e4220) - thanks @​mkantautas!
• Follow npm lifecycle scripts and run-script aliases (#2202) (89dfdc881e6865aef326c2b9dc700cf5c46b73b4) - thanks @​sushanta-neupane!
• Follow pnpm t, tst and run-script aliases (ce91e230e0823433dfcc1ee4562335c34d2b73ef)
• Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils) (db9aa7443c5b3839df5c0fe320d78ea42f0f3446)
• Ignore tool output before the first report section in ecosystem snapshots (9434bf678e60d16832f13e892d7c1ebc2b9e6ed1)
• Update dependencies (21c3b75fc4ae94208311abb630ff129fcd9fe820)
• Bump engines.node to follow Astro's (9d7a5e07212b093f9d422cab813fad5d01273fc6)

Release 6.42.1

• fix(semantic-release): resolve shareable configs from extends (#2159) (4c4a5ece9148cf621f3a6e091fd3550b18f6e19a) - thanks @​giaBaoJS!
• fix(jest): load projects entries as Jest configs (#2167) (4c22593724460890e4492ba86119d0188127f2ba) - thanks @​Cayan!
• Update npmx.dev snapshot (4b19797b77a559f7190e9119b3a156e1ac6aef9f)
• fix(tailwind): track packages referenced from CSS url() (#2166) (949da00abf419c1eeabdab1541ce7e5c312371b9) - thanks @​agustincastaing!
• Add .otf to foreign file extensions (fcff4db0b88d6282569743cd779aec5a5df99862)
• Match quoted SCSS url() values within a single line (2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c)
• fix(bun): treat bun test arguments as path filters (#2165) (5f3a7fb526d3eca7561aacfc9d0ac60056525206) - thanks @​jakeleventhal!
• fix(vitest): use default test entries when config has no test key (#2170) (7ee576ccd461f719b533e3783a5b58391ce89e91) - thanks @​fixfon!

Commits

• 0712156 Release knip@6.43.0
• 21c3b75 Update dependencies
• db9aa74 Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils)
• ce91e23 Follow pnpm t, tst and run-script aliases
• 89dfdc8 Follow npm lifecycle scripts and run-script aliases (#2202)
• ec293d1 Resolve function and promise entries in Vitest test.projects (#2197)
• 12e4355 Add Electron Forge plugin (#2158)
• 813fa30 Mark YAML catalog entries fixed only when their line is removed (#2201)
• 3601c6e Detect .travis.yml with a stat instead of a glob
• 204a809 Skip --fix export ranges inside a larger removal
• Additional commits viewable in compare view

Updates @google-cloud/bigquery from 9.3.0 to 9.5.0

Release notes

Sourced from @​google-cloud/bigquery's releases.

bigquery: v9.5.0

9.5.0 (2026-10-23)

Features

• bigquery: Allow WRITE_APPEND in createQueryArrowStream (#9648) (2062403)
• bigquery: Resume interrupted Arrow ReadRows streams (#9602) (8372c9e)
• bigquery: Stream multi-page Arrow results from default job stream (#9598) (1aa6eb4)
• bigquery: Support arrowSerializationOptions in createQueryArrowStream (#9603) (2449fe4)
• bigquery: Support explicit destination tables in createQueryArrowStream (#9601) (f22e2dd)
• bigquery: Support jobs.insert in createQueryArrowStream (#9600) (4c414c6)
• bigquery: Support maxResults in createQueryArrowStream (#9605) (a7fdd05)
• bigquery: Wait for unfinished jobs before streaming Arrow results (#9599) (5e465b7)

Bug Fixes

• bigquery: Preserve timestamp nanoseconds when microseconds are zero (#9650) (f6ca61d)
• bigquery: Raise when an Arrow batch arrives before its schema (#9681) (576a42e)

bigquery: v9.4.0

9.4.0 (2026-10-19)

Features

• bigquery: Add createQueryArrowStream for inline jobs.query results (#9596) (69157ed)

firestore: v9.4.0

9.4.0 (2026-10-22)

Features

• firestore: Add DML stages (insert, upsert, delete, update), literals source, and atomic execution option to Node SDK pipelines (2639650)

Bug Fixes

• firestore,pubsub: Align types and proto re-exports with -api packages (#9621) (25d945b)
• firestore: Resolve api-extractor from cloud-rad in api-report.mjs (#9505) (dc83ed8)

googleapis-common: v9.3.1

9.3.1 (2026-10-14)

Bug Fixes

• core: Remove --fetch-shim and handle Bun fetch natively (#9573) (62559f1)

... (truncated)

Changelog

Sourced from @​google-cloud/bigquery's changelog.

9.5.0 (2026-10-23)

Features

• bigquery: Allow WRITE_APPEND in createQueryArrowStream (#9648) (2062403)
• bigquery: Resume interrupted Arrow ReadRows streams (#9602) (8372c9e)
• bigquery: Stream multi-page Arrow results from default job stream (#9598) (1aa6eb4)
• bigquery: Support arrowSerializationOptions in createQueryArrowStream (#9603) (2449fe4)
• bigquery: Support explicit destination tables in createQueryArrowStream (#9601) (f22e2dd)
• bigquery: Support jobs.insert in createQueryArrowStream (#9600) (4c414c6)
• bigquery: Support maxResults in createQueryArrowStream (#9605) (a7fdd05)
• bigquery: Wait for unfinished jobs before streaming Arrow results (#9599) (5e465b7)

Bug Fixes

• bigquery: Preserve timestamp nanoseconds when microseconds are zero (#9650) (f6ca61d)
• bigquery: Raise when an Arrow batch arrives before its schema (#9681) (576a42e)

9.4.0 (2026-10-19)

Features

• bigquery: Add createQueryArrowStream for inline jobs.query results (#9596) (69157ed)

Commits

• b3a9687 chore: release main (#9684)
• f6ca61d fix(bigquery): preserve timestamp nanoseconds when microseconds are zero (#9650)
• 576a42e fix(bigquery): raise when an Arrow batch arrives before its schema (#9681)
• 2062403 feat(bigquery): allow WRITE_APPEND in createQueryArrowStream (#9648)
• a7fdd05 feat(bigquery): support maxResults in createQueryArrowStream (#9605)
• 2449fe4 feat(bigquery): support arrowSerializationOptions in createQueryArrowStream (...
• 8372c9e feat(bigquery): resume interrupted Arrow ReadRows streams (#9602)
• f22e2dd feat(bigquery): support explicit destination tables in createQueryArrowStream...
• 4c414c6 feat(bigquery): support jobs.insert in createQueryArrowStream (#9600)
• 5e465b7 feat(bigquery): wait for unfinished jobs before streaming Arrow results (#9599)
• Additional commits viewable in compare view

Updates @google-cloud/datastore from 11.3.0 to 11.3.1

Release notes

Sourced from @​google-cloud/datastore's releases.

google-auth-library: v11.3.1

11.3.1 (2026-10-14)

Bug Fixes

• core: Remove --fetch-shim and handle Bun fetch natively (#9573) (62559f1)
• core: Remove --gaxios-shim and configure Bun Gaxios fetch (#9569) (640bf51)

datastore: v11.3.1

11.3.1 (2026-10-23)

Bug Fixes

• datastore: Align Transaction JSDoc @​extends tag with DatastoreRequest (#9671) (733e9f1)

Changelog

Sourced from @​google-cloud/datastore's changelog.

11.3.1 (2026-10-23)

Bug Fixes

• datastore: Align Transaction JSDoc @​extends tag with DatastoreRequest (#9671) (733e9f1)

Commits

• b3a9687 chore: release main (#9684)
• 733e9f1 fix(datastore): align Transaction JSDoc @​extends tag with DatastoreRequest (#...
• 703154b chore: release main (#9584)
• d07cb88 chore: release main (#9547)
• a5eec89 feat(tools): add individual CLI flags for Bun monkey patches (#9533)
• eb4cf9e test: run bun handwritten tests in bun runtime for firestore through pubsub p...
• 5e36a6b test: update first half of handwritten libraries to be bun compatible (#9448)
• 3cc13fe chore: release main (#9295)
• 3ff5ae9 chore: update .nycrc, Contributing.md, and .gitignore across packages (#9144)
• 1ea27c9 feat: PNPM workspace (#8973)
• Additional commits viewable in compare view

Updates @google-cloud/pubsub from 6.3.0 to 6.3.1

Release notes

Sourced from @​google-cloud/pubsub's releases.

pubsub: v6.3.1

6.3.1 (2026-10-19)

Bug Fixes

• firestore,pubsub: Align types and proto re-exports with -api packages (#9621) (25d945b)

Changelog

Sourced from @​google-cloud/pubsub's changelog.

6.3.1 (2026-10-19)

Bug Fixes

• firestore,pubsub: Align types and proto re-exports with -api packages (#9621) (25d945b)

Commits

• See full diff in compare view

Updates @kubernetes/client-node from 2.0.0 to 2.0.1

Release notes

Sourced from @​kubernetes/client-node's releases.

Release 2.0.1

Full Changelog: kubernetes-client/javascript@2.0.0...2.0.1

Commits

• 1c811ad Pin node version in release workflow
• 73e4414 Prepare 2.0.1
• b02ad64 ci: pin the Node 26 matrix entry to 26.7
• 4895d44 fix: use inactivity timeout for watch instead of whole-request timeout
• See full diff in compare view

Updates @aws-sdk/client-s3 from 3.1152.0 to 3.1156.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1156.0

3.1156.0(2026-10-22)

Documentation Changes

• client-lambda: AWS Lambda durable functions now supports payloads up to 1 MB for checkpoints, callback completion, and error details. (cdd6c609)

New Features

• clients: update client endpoints as of 2026-10-22 (e5cd1562)
• client-opensearchserverless: Adds APIs to create, get, list, and cancel ingestion jobs, and to create, get, list, and delete ingestion streams, for ingesting data from Amazon S3 into OpenSearch Serverless collections. (7712bce0)
• client-continuum: Releasing Continuum for Code Vulnerabilities APIs for SDKs (0cbbd64c)
• client-connect: Adds support for customer queryable replication errors. (4507ef01)
• client-ec2: AWS Transit Gateway now provides managed one-to-one NAT directly on its attachments, through integration with Regional Private NAT Gateway. Use ModifyTransitGatewayAttachmentNatConfiguration to enable NAT and configure NAT rules, and GetTransitGatewayAttachmentNatConfiguration to view them. (68bea2ce)
• client-bedrock-agentcore: Adds the dimension name to evaluation results and batch evaluation summaries. For multi-dimensional LLM-as-a-Judge evaluators, each result and summary now identifies which dimension it corresponds to. (185f264b)
• client-networkmanager: AWS Cloud WAN now provides managed one-to-one NAT directly on it's core network attachments, through integration with Regional Private NAT Gateway. Use UpdateAttachmentNatConfiguration to enable NAT and configure NAT rules, and ListAttachmentNatConfigurations to view them. (944335d4)
• client-bedrock-agentcore-control: Adds model-based routing and fallback to AgentCore Gateway rules. Rules can match the requested model, route to a specific model, and fall back across inference targets with an optional circuit breaker. Adds multi-dimensional rating scales for AgentCore Evaluations LLM-as-a-Judge evaluators. (9c2b09c2)
• client-elementalinference: Elemental Inference now supports feed scheduling, letting you apply feed configuration changes at a time you choose instead of building your own automation. (b4108829)
• client-glue: Add support for large worker types in AWS Glue (89ac4073)
• client-kafkaconnect: Amazon MSK Connect now supports pausing and resuming connectors via the asynchronous PauseConnector and ResumeConnector APIs. Paused connectors keep their configuration and committed offsets and resume where they left off. Each call returns an operation ARN to track with DescribeConnectorOperation. (f5a4343a)
• client-ivs-realtime: Adds RevokeConnectionToken operation for Amazon IVS Real-Time Streaming. (7c85a26a)

---

For list of updated packages, view updated-packages.md in assets-3.1156.0.zip

v3.1155.0

3.1155.0(2026-10-21)

Chores

• temporarily disconnect from eclipse for Java formatting (#8375) (6d14aac7)
• codegen: sync for JSON string serializer buffer fix and retryMode docs link (#8373) (5f53137d)
• finspace: Remove finspace and finspace-data clients following the service shutdown (#8369) (48e34c48)
• tnb: Remove tnb clients following shutdown (#8370) (e37bf8c2)

New Features

• client-quicksight: Adds support for SharePoint and OneDrive two-legged OAuth certificate credentials and Google Workspace service account credentials when creating data sources (d0d47ac9)
• client-sfn: Release minor updates to API model (6bb8593f)
• client-network-firewall: Adds support for Network Firewall Resolved IP validation. (6a634360)
• client-datazone: Added custom designations support with new CRUD APIs. The designation field in project membership and policy grant APIs supports a new enum for custom designations. These APIs also support a new field for custom designation id. (10021565)
• client-ec2: Adds new response fields to DescribeInstanceStatus and Network Insights analysis results. (8e379695)
• client-lightsail: This release adds support for metrics related to system-disk performance. (d21dd9d9)
• client-healthlake: Update the UpdateProfileWithAgent API to return a streaming response to provide more frequent updates on what the agent is doing. (c2730b30)
• client-polly: Added support for the new voices - Kenneth (en-US), Nate (en-US), Tina (de-DE), Carlos (es-US), Carolina (pt-BR), Leo (pt-BR), Curtis (en-AU), Kiara (en-IN), Arjun (en-IN) and Hyunduk (ko-KR). They are available as a Generative voices only. (4494f473)
• client-connect: Added support for AWS-managed security profiles. (04f0c0b5)
• client-auto-scaling: EC2 Auto Scaling now supports account settings, letting you manage account-level configuration for Auto Scaling. (d0cdb396)
• client-lex-models-v2: Adds support for Assisted NLU - Dialog Manager mode allowing usage of LLMs as the default NLU system and dialog management (671f2125)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1156.0 (2026-10-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1155.0 (2026-10-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1154.0 (2026-10-20)

Note: Version bump only for package @​aws-sdk/client-s3

3.1153.0 (2026-10-19)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

• 163a566 Publish v3.1156.0
• 7c2f089 Publish v3.1155.0
• 5f53137 chore(codegen): sync for JSON string serializer buffer fix and retryMode docs...
• f6ff312 Publish v3.1154.0
• 3508584 Publish v3.1153.0
• 3e350b5 chore(codegen): sync for JSON codec and schema server plugin (#8353)
• See full diff in compare view

Updates mockserver-client from 9.0.0 to 9.1.0

Release notes

Sourced from mockserver-client's releases.

MockServer 9.1.0

[9.1.0] - 2026-10-21

Security

• Control-plane mTLS could be bypassed by sending the CA certificate after an untrusted client certificate. With controlPlaneTLSMutualAuthenticationRequired on, MockServer 5.13.0 to 9.0.0 accepted a control-plane request if any certificate the client sent could be validated against controlPlaneTLSMutualAuthenticationCAChain. A CA certificate is public, so anyone who could reach the control plane could send their own certificate followed by your CA certificate and create, read or delete expectations, change the configuration or reset the server, without the CA's private key. Also requiring data-plane mTLS (tlsMutualAuthenticationRequired) did not prevent this in the default set-up: the data-plane check also trusts MockServer's own CA, which by default is the CA bundled with MockServer, and its private key is published in the jar, so an attacker could sign their certificate with it. Data-plane mTLS prevented it only if MockServer had its own CA (certificateAuthorityCertificate and certificateAuthorityPrivateKey, or dynamicallyCreateCertificateAuthorityCertificate) and every CA in tlsMutualAuthenticationCertificateChain was private. MockServer now checks only the client's own certificate (the one whose private key it used for the connection): it must be signed by a CA in the chain, directly or through intermediate CA certificates the client sends after it, be in date, allow digital signatures if it lists key usages, allow client authentication if it lists extended key usages, and not be a CA certificate, a self-signed certificate or one of the certificates in the chain. A self-signed client certificate listed in controlPlaneTLSMutualAuthenticationCAChain is no longer accepted; sign client certificates with a CA instead. A controlPlaneTLSMutualAuthenticationCAChain that contains the bundled CA (or any certificate for its key) is now refused: MockServer does not start, PUT /mockserver/configuration answers 400, and any other change makes every control-plane request fail, where before only a warning was logged. If MockServerClient and MockServer share that property in one JVM (for example ClientAndServer or the JUnit rule) and you added the bundled CA so the client trusts MockServer's certificate, give MockServer its own CA with certificateAuthorityCertificate and certificateAuthorityPrivateKey and put that CA in the chain instead. The control-plane audit log now records the validated client certificate's subject as a verified principal (verified-mtls) unless OIDC supplied one; with mTLS and JWT both on, the audit principal is now the certificate subject instead of the unverified JWT sub. If a MockServer reachable by others had control-plane mTLS on, with or without data-plane mTLS, treat its expectations, recorded traffic and settings as possibly read or changed by someone else
• mTLS (tlsMutualAuthenticationRequired) no longer accepts client certificates anyone can create (BREAKING for mTLS set-ups that use MockServer's default CA; see upgrading to 9). Up to 9.0.0, MockServer trusted client certificates signed by MockServer's own CA whenever mTLS was on, even with tlsMutualAuthenticationCertificateChain set. By default that CA is the one bundled with MockServer, and its private key is published in the MockServer jar, so anyone could create a client certificate, with any name, that MockServer accepted. That client also matched any client certificate condition in your expectations and, when control-plane authentication was off, could create, read or delete expectations. MockServer now never trusts the bundled CA for mTLS. If mTLS is on and nothing but the bundled CA would be trusted, or tlsMutualAuthenticationCertificateChain contains the bundled CA, MockServer does not start, PUT /mockserver/configuration answers 400, and the message names the fix: give MockServer its own CA with certificateAuthorityCertificate and certificateAuthorityPrivateKey, set dynamicallyCreateCertificateAuthorityCertificate=true, or set tlsMutualAuthenticationCertificateChain to the CA that signs your client certificates. With a chain set and the default CA, MockServer now trusts only the chain. For a throwaway local test, the new tlsMutualAuthenticationAllowBundledCa=true restores the old behaviour, and a warning is logged whenever the bundled CA becomes trusted (at startup, when a configuration change makes it trusted, and when the TLS context is rebuilt). This applies to HTTPS and HTTP/3. If a MockServer reachable by others relied on mTLS with the default CA, treat its expectations and recorded traffic as possibly read or changed by someone else
• Dashboard: a crafted dashboard link can no longer make the dashboard reset, clear or stop the MockServer that serves it. The dashboard reads ?host=, ?port= and ?basePath= from its own address and used them unchecked to build every call it makes to MockServer, so a link such as …/mockserver/dashboard?basePath=/mockserver/reset%23 turned the dashboard's next routine call into /mockserver/reset as soon as someone opened it. These values now go through the same checks as a server typed into Set MockServer: a host must be a plain host name or IP address (no scheme, path, @ or #), a port a number from 1 to 65535, and a base path a plain path (no ?, #, %, \, // or ./.. segments). An invalid value is ignored, the dashboard uses the server that served it instead, and a warning at the top of the dashboard names what was ignored. A valid link that points the dashboard at a server on a different host now shows a warning naming that server, because what you create in the dashboard is sent there, with a button to switch back to the server that served the page; that server no longer decides whether dashboard analytics are on (the server that served the page still does). Valid links on the same host, such as ?port=1080 or ?basePath=/mock, work as before with no warning. A dashboard served behind a proxy under a path containing a percent-encoded character (for example a space) now falls back to the root path, with the same warning; pass ?basePath= to set it. The stricter base-path check also applies to Set MockServer, and a saved workspace target whose base path contains % or \ is dropped, so that workspace follows the dashboard's address again
• Load scenarios: a STAIRS load shape with a huge steps value (for example 2147483647) could exhaust the server's memory when it was loaded with PUT /mockserver/loadScenario, before the stage limit was checked. A shape is now checked against the stage limit (loadGenerationMaxStages, 20 by default) before it is expanded, and rejected with 400 Bad Request if it is too big; no shape can expand to more than 10,000 stages. Stage durations so large that their total wrapped past the maximum run duration are now rejected too, and so is NaN or Infinity in any number in a load scenario (stage rates, shape parameters, step weights, the pacing value and thresholds); before, a NaN step weight made a weighted scenario fail once it ran. A VU shape value too big for a whole number of virtual users is now rejected by the virtual-user limit instead of silently wrapping to a small or negative count
• Node, Python, Go, Rust and .NET clients: the callback and breakpoint WebSocket now carries the client's configured control-plane bearer token as Authorization: Bearer <token>, as control-plane HTTP calls already did, so callbacks and breakpoints keep working when MockServer requires JWT or OIDC control-plane authentication on that WebSocket. A token supplier is asked for a fresh token on each connection, including the Node and Python clients' reconnects. With no token configured nothing is sent, and a MockServer that does not require authentication ignores the header. In a browser the Node client cannot send it, because browsers do not let a page set headers on a WebSocket and MockServer accepts the token only in that header; use mutual TLS for browser callbacks and breakpoints when control-plane authentication is on. The Ruby client has no control-plane token option and the PHP client has no callback WebSocket, so neither changes
• Log lines can no longer be forged through request data. The forward circuit breaker's log messages (which name the upstream, which can come from a request's Host header or HTTP/2 :authority) and the LLM conversation matcher's debug messages (which quote the request body) now write carriage returns, line feeds and other control characters as escapes such as \r and \n, so a crafted request cannot start a new log line
• By default, web pages on other sites can no longer use MockServer's API or WebSockets from your browser (BREAKING; see upgrading to 9). Since 7.0.0, MockServer's own API (every /mockserver/... path, including MCP ...

  Description has been truncated